CVE-2026-85990 Leantime: Any Authenticated User Can Self-Escalate to Admin via Unauthorized JSON-RPC Methods

Leantime is an open source project management system. Prior to 3.10.0, for the provisionally grouped account-creation and plugin-management surfaces, Leantime's JSON-RPC dispatcher in app/Domain/Api/Controllers/Jsonrpc.php exposes public API service methods, while PermissionEnforcer::enforce allo...

CVE-2026-85990 Leantime: Any Authenticated User Can Self-Escalate to Admin via Unauthorized JSON-RPC Methods

Leantime is an open source project management system. Prior to 3.10.0, for the provisionally grouped account-creation and plugin-management surfaces, Leantime's JSON-RPC dispatcher in app/Domain/Api/Controllers/Jsonrpc.php exposes public API service methods, while PermissionEnforcer::enforce allo...

LatePoint – Calendar Booking Plugin for Appointments and Events: Authorization Issues Vulnerability

LatePoint – Calendar Booking Plugin for Appointments and Events. Versions 5.7.3 and earlier have an authorization issue vulnerability. This vulnerability stems from a lack of ownership checks on the bookingid and cartid parameters. Unauthorized attackers can enumerate booking or cart identifiers...

WordPress Social Share Buttons & Analytics Plugin – GetSocial.io Cross-site Script Vulnerability

WordPress Social Share Buttons & Analytics Plugin – GetSocial.io versions 4.5 and earlier have a cross-site scripting vulnerability. This vulnerability stems from improper cleaning of response parameter inputs and improper output escaping, allowing authenticated attackers to inject arbitrary web...

WordPress BP Profile Search plugin <= 5.9 - Unauthenticated Local File Inclusion to Remote Code Execution vulnerability

Unauthenticated Local File Inclusion to Remote Code Execution vulnerability discovered by snr in WordPress Plugin BP Profile Search versions = 5.9...

WordPress Bit integrations – Form Integration, Webhook, Spreadsheets, CRM, LMS & Email Automation plugin <= 2.10.6 - Unauthenticated Privilege Escalation vulnerability

Unauthenticated Privilege Escalation vulnerability discovered by crow in WordPress Plugin Bit Integrations versions = 2.10.6...

WordPress Broken Link Checker plugin <= 2.4.14.1 - Content Injection vulnerability

Content Injection vulnerability discovered by changsheng in WordPress Plugin Broken Link Checker versions = 2.4.14.1...

nvidia-dali-tf-plugin-cuda120 (2.2.0) potentially affected by CVE-2026-65148 via nvidia-dali-cuda120 (2.2.0)

nvidia-dali-cuda120 PYPI version 2.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on nvidia-dali-cuda120 and may be impacted: - nvidia-dali-tf-plugin-cuda120 2.2.0 Source cves: CVE-2026-65148 Source advisory: MEND:CVE-2026-65148...

nvidia-dali-tf-plugin-cuda120 (2.2.0) potentially affected by CVE-2026-65150 via nvidia-dali-cuda120 (2.2.0)

nvidia-dali-cuda120 PYPI version 2.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on nvidia-dali-cuda120 and may be impacted: - nvidia-dali-tf-plugin-cuda120 2.2.0 Source cves: CVE-2026-65150 Source advisory: MEND:CVE-2026-65150...

nvidia-dali-tf-plugin-cuda120 (2.2.0) potentially affected by CVE-2026-65149 via nvidia-dali-cuda120 (2.2.0)

nvidia-dali-cuda120 PYPI version 2.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on nvidia-dali-cuda120 and may be impacted: - nvidia-dali-tf-plugin-cuda120 2.2.0 Source cves: CVE-2026-65149 Source advisory: MEND:CVE-2026-65149...

nvidia-dali-tf-plugin-cuda120 (2.2.0) potentially affected by CVE-2026-65147 via nvidia-dali-cuda120 (2.2.0)

nvidia-dali-cuda120 PYPI version 2.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on nvidia-dali-cuda120 and may be impacted: - nvidia-dali-tf-plugin-cuda120 2.2.0 Source cves: CVE-2026-65147 Source advisory: MEND:CVE-2026-65147...

SQL Injection

Overview @payloadcms/plugin-mcp is a MCP Model Context Protocol capabilities with Payload Affected versions of this package are vulnerable to SQL Injection via improper escaping of string values in parseParams when constructing JSON queries for in and notin operators. An authenticated attacker ca...

WordPress Amelia plugin <= 2.4.10 - SQL Injection vulnerability

SQL Injection vulnerability discovered by AndrewN in WordPress Plugin Amelia versions = 2.4.10...

WordPress MLS On The Fly plugin <= 1.8.1.5 - SQL Injection vulnerability

SQL Injection vulnerability discovered by Rafie Muhammad in WordPress Plugin MLS On The Fly versions = 1.8.1.5...

WordPress Prime Slider – Addons For Elementor plugin <= 4.7.1 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by nh4tvd in WordPress Plugin Prime Slider – Addons For Elementor versions = 4.7.1...

CVE-2026-109684 WordPress Amelia plugin <= 2.4.10 - Broken Access Control vulnerability

Missing Authorization vulnerability in TMS Amelia ameliabooking allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Amelia: from n/a through 2.4.10...

WordPress Amelia plugin <= 2.4.10 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Parlix in WordPress Plugin Amelia versions = 2.4.10...

WordPress WPGraphQL plugin <= 2.23.1 - Sensitive Data Exposure vulnerability

Sensitive Data Exposure vulnerability discovered by Heinrihs Skrodelis in WordPress Plugin WPGraphQL versions = 2.24.2...

WordPress Razorpay Payment Button Elementor Plugin plugin <= 1.2.8 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Razorpay Payment Button Elementor Plugin versions = 1.2.8...

Malicious code in orderly-plugin-liquidity-heatmap (npm)

orderly-plugin-liquidity-heatmap poses as a liquidity heatmap plugin for the Orderly Network orderbook widget, but its only export is an empty stub and a postinstall hook runs node ./scripts/setup.js on npm install. When the script detects GitHub Actions CI and GITHUBWORKSPACE set, it records the...